# PhotoRec Step By Step

### From CGSecurity

english version deutsche Version version française versione italiana Русская версия

This Recovery example guides you through PhotoRec step by step to recover deleted files or lost data from a reformated partition or corrupted filesystem. For lost/deleted partition or deleted files from FAT or NTFS filesystem, try TestDisk first, it's usually faster. Translation of this PhotoRec manual to other languages are welcome.

## Run PhotoRec executable

If PhotoRec is not yet installed, it can be downloaded from TestDisk Download. Extract the files from the archive including the sub-directories.

To recover files from hard disk, USB key, Smart Card, cdrom, dvd..., you need enough rights to access physical device.

- Under Dos, run photorec.exe
- Under Windows, start PhotoRec (ie testdisk-6.9/win/photorec_win.exe) from an account in the Administrator Group. Under Vista, use right-click "run as administrator" to launch PhotoRec.
- Under Unix/Linux/BSD, you need to be root to run PhotoRec (ie. `sudo testdisk-6.9/linux/photorec_static`)
- Under MacOSX, start PhotoRec (ie testdisk-6.9/darwin/photorec). If you are not root, PhotoRec will restart itself using sudo after confirmation of your part, sudo will ask for a password, enter your Mac OS X user password.
- Under OS/2, PhotoRec doesn't handle physical device, only disk image, sorry.

To recover files from a media image, run

- `photorec image.dd` to carve a raw disk image
- `photorec image.E01` to recover files from an Encase EWF image
- `photorec 'image.*'` if the Encase image is split into several files.
- `photorec '/cygdrive/d/evidence/image.*'` if the Encase image is split into several files in the directory d:\evidence

To recover files from other devices, run `photorec device`, i.e.

- `photorec /dev/mapper/truecrypt0` to recover files from a TrueCrypt partition. The same method works with filesystem encrypted with cryptsetup/dm-crypt/LUKS.
- `photorec /dev/md0` to recover files from a Linux software Raid device.

Forensics users can use the parameter `/log` to create a log file named `photorec.log`; it records the location of the files recovered by PhotoRec.

## Disk selection

Available media are listed. Use up/down arrow keys to select the disk that holds the lost files. Press `Enter` to proceed.

If available, use raw device `/dev/rdisk*` instead of `/dev/disk*` for faster data transfer.

## Partition table type selection

Select the partition table type, usually the default value is the correct one as PhotoRec auto-detects the partition table type.

## Source partition selection

Choose

- `Search` after selecting the partition that holds the lost files to start the recovery,
- `Options` to modify the options,
- `File Opt` to modify the list of file types recovered by PhotoRec.

## PhotoRec options

- `Paranoid` By default, recovered files are verified and invalid files rejected.

Enable `bruteforce` if you want to recover more fragmented JPEG files, note it's a very CPU intensive operation.

- `Allow partial last cylinder` modifies how the disk geometry is determined, only non-partitioned media should be affected.
- The `expert mode` option allows the user to force the filesystem blocksize and the offset.
- Enable `Keep corrupted files` to keep files even if they are invalid in the hope that data may still be salvaged from an invalid file using other tools.
- Enable `Low memory` if your system doesn't have enough memory and crashes during recovery. It may be needed for large filesystems heavily fragmented. Don't use this option unless absolutely necessary.

## Selection of files to recover

Enable or disable the recovery of certain file types, e.g.

    [X] tif  Tag Image File Format and some raw file formats (pef/nef/dcr/sr2/cr2)
    ...
    [X] zip  zip archive including OpenOffice and MSOffice 2007

The whole list of file formats recovered by PhotoRec contains more than 100 file families representing more than 180 file extensions.

## Filesystem type

Once a partition has been selected, PhotoRec needs to know how the data blocks are allocated. Unless it's ext2/ext3 filesystem, choose `Other`.

## Carve the partition or unallocated space only

PhotoRec can search files from

- from the whole partition (useful if the partition is badly corrupted) or
- from the unallocated space only (Available for ext2/ext3, FAT12/FAT6/FAT32 and NTFS). With this option only deleted files are recovered.

## Select where recovered files should be written

Choose the directory where the recovered files should be written.

- Select `..` several times to get the drive list (C:, D:, E:...)
- Filesystem from external disk may be available in a `/media` or `/mnt` sub-directory.
- Partitions from external disk are usually mounted in `/Volumes`.

## Recovery in progress

Number of recovered files is updated in real time.

- During pass 0, PhotoRec searches the first 10 files to determine the blocksize.
- During pass 1 and later, files are recovered including some fragmented files.

Recovered files are written in recup_dir.1, recup_dir.2... sub-directories. It's possible to access the files even if the recovery is not finished.

## Recovery is completed

When the recovery is complete, a summary is displayed. Note that if you interrupt the recovery, the next time PhotoRec is restarted you will be asked to resume the recovery.

- After Using PhotoRec: Some ideas to sort recovered files or repair broken ones.
- You may have disabled your antivirus live protection during the recovery to speedup the process but it's recommended to scan the recovered files for virus before opening them, PhotoRec may have undelete an infected document or a trojan.

Category: Data Recovery